analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ZCrack_Spotify.rar

Full analysis: https://app.any.run/tasks/2b69cd64-1de4-409d-a71a-7a2868a9df98
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: May 30, 2020, 19:46:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
blacknet
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

7F2113DDD0A7AC6A1FF5D24946B1D848

SHA1:

B9470D68E55D032CDDCF5AA5A5EBE8EDF38AE9A9

SHA256:

6E38DFF46CCE04477E526BB2E6D384D3120D02BED576D89E7280F6E726C0D9B5

SSDEEP:

12288:zXYFj7wkxVHuZ3Ypl/3/hmRQ2Maa5ti3cz4P1nOxn2d+MSfpZfOR68PGHMp4/v:zg7wkxVYIph3/hmRKaaeHgZ2dafpZ2g3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1892)

    • Application was dropped or rewritten from another process

      • ZCrack Spotify.exe (PID: 3716)
      • MSBuild.exe (PID: 3972)
      • WindowsUpdate.exe (PID: 2536)

    • Connects to CnC server

      • MSBuild.exe (PID: 3972)

    • BLACKNET was detected

      • MSBuild.exe (PID: 3972)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 1468)

    • Changes the autorun value in the registry

      • MSBuild.exe (PID: 3972)

  • SUSPICIOUS

    • Executes application which crashes

      • ZCrack Spotify.exe (PID: 3716)

    • Reads Internet Cache Settings

      • ZCrack Spotify.exe (PID: 3716)
      • MSBuild.exe (PID: 3972)

    • Executable content was dropped or overwritten

      • MSBuild.exe (PID: 3972)

    • Starts CMD.EXE for self-deleting

      • MSBuild.exe (PID: 3972)

    • Starts CMD.EXE for commands execution

      • MSBuild.exe (PID: 3972)

    • Starts itself from another location

      • MSBuild.exe (PID: 3972)

  • INFO

    • Manual execution by user

      • ZCrack Spotify.exe (PID: 3716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs searchprotocolhost.exe no specs zcrack spotify.exe ntvdm.exe no specs #BLACKNET msbuild.exe cmd.exe no specs ping.exe no specs windowsupdate.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2800"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ZCrack_Spotify.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1892"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3716"C:\Users\admin\Desktop\ZCrack Spotify.exe" C:\Users\admin\Desktop\ZCrack Spotify.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3064"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—ZCrack Spotify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3972"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v2.0.50727\\\\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
ZCrack Spotify.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
2.0.50727.5420 built by: Win7SP1
1468"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Windows\System32\cmd.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3488ping 1.1.1.1 -n 1 -w 4000 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2536"C:\Users\admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe" C:\Users\admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
1
Version:
2.0.50727.5420 built by: Win7SP1
Total events
2 879
Read events
1 248
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
4
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
2800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2800.35345\ZCrack Spotify.exe —
MD5:—
SHA256:—
2800WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2800.35345\xNet-Ameliorated.dll —
MD5:—
SHA256:—
3716ZCrack Spotify.exeC:\Users\admin\AppData\Local\Temp\Cab9CC.tmp —
MD5:—
SHA256:—
3716ZCrack Spotify.exeC:\Users\admin\AppData\Local\Temp\Tar9CD.tmp —
MD5:—
SHA256:—
3064ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsBD0.tmp —
MD5:—
SHA256:—
3064ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsBD1.tmp —
MD5:—
SHA256:—
3716ZCrack Spotify.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\ZCrack%20Spotify[1].htmtext
MD5:29FC87E5250187F567B7C996E5566088
SHA256:3F225F34DBAC39ECFDBB585556D283211823D42951A2B473F06892D4F8231883
3716ZCrack Spotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F8B869FA1CD90ADD26C3609539D398B7der
MD5:4DC2FC916E3B3A7AD9A7189FEB4EAE14
SHA256:C279B3E050C4607526ACBB89559A520972151C40B5E25CD7954049D147E04D42
3972MSBuild.exeC:\Users\admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exeexecutable
MD5:1F13CD7F1ECB2A7BCC1FF5E287B7EB2E
SHA256:6ADC88FC0A0E108851909618442C03F57CDFC20F6DB4EE88B84C0CAF420F991F
3716ZCrack Spotify.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:FABE66F6C09EA2E22FB75534D5F2834B
SHA256:F9C09E24BD256FC300B86FA4A0CE870A20B2A1F7B3AE142038927DD1223B8D2E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3716
ZCrack Spotify.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3716
ZCrack Spotify.exe
GET
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMdiyC7%2FEzuSZe6lcIIgRRuqA%3D%3D
unknown
der
527 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3716
ZCrack Spotify.exe
178.170.41.149:443
srv-file14.gofile.io
Ikoula Net SAS
FR
unknown
3716
ZCrack Spotify.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3716
ZCrack Spotify.exe
2.16.186.35:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3972
MSBuild.exe
45.95.168.70:80
mozillaupdater.com
—
—
malicious

DNS requests

Domain
IP
Reputation
srv-file14.gofile.io
  • 178.170.41.149
unknown
isrg.trustid.ocsp.identrust.com
  • 2.16.186.35
  • 2.16.186.11
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.11
  • 2.16.186.27
whitelisted
mozillaupdater.com
  • 45.95.168.70
malicious

Threats

PID
Process
Class
Message
3972
MSBuild.exe
A Network Trojan was detected
ET TROJAN Win32/BlackNET CnC Keep-Alive
3972
MSBuild.exe
A Network Trojan was detected
ET TROJAN Win32/BlackNET CnC Keep-Alive
3972
MSBuild.exe
A Network Trojan was detected
ET TROJAN Win32/BlackNET CnC Keep-Alive
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ZCrack_Spotify.rar